From 4c9b6bba9650595052653435311ec6e650df0324 Mon Sep 17 00:00:00 2001
From: mariomitte <mario_mitte@hotmail.com>
Date: Fri, 10 Jul 2026 23:00:06 +0200
Subject: [PATCH] patch CSRF and CI

---
 .gitea/workflows/ci.yml              | 62 +++++++++++++++++++++-------
 backend/core/settings/base.py        |  1 -
 backend/core/settings/development.py | 12 ++++++
 backend/core/settings/production.py  | 10 +++++
 4 files changed, 69 insertions(+), 16 deletions(-)

diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 24ab30c..2cbea04 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -1,6 +1,24 @@
-name: ERP CI Pipeline
+name: ERP CI/CD Pipeline
 
-on: [push, pull_request]
+on:
+  push:
+    branches: [main, master]
+    paths:
+      - "backend/**"
+      - "frontend/**"
+      - "docker-compose*.yml"
+      - ".gitea/workflows/ci.yml"
+  pull_request:
+    branches: [main, master]
+    paths:
+      - "backend/**"
+      - "frontend/**"
+      - "docker-compose*.yml"
+      - ".gitea/workflows/ci.yml"
+
+concurrency:
+  group: erp-${{ github.ref_name }}
+  cancel-in-progress: true
 
 jobs:
   test:
@@ -12,28 +30,42 @@ jobs:
           POSTGRES_DB: erp_db
           POSTGRES_PASSWORD: password
     steps:
-      - name: Checkout code
-        uses: actions/checkout@v3
+      - name: Checkout
+        uses: actions/checkout@v4
 
-      - name: Set up Python
-        uses: actions/setup-python@v4
+      - name: Setup Python
+        uses: actions/setup-python@v5
         with:
-          python-version: '3.11'
+          python-version: "3.11"
 
-      - name: Install dependencies
+      - name: Install deps
         run: |
           pip install -r backend/requirements.txt
           pip install pytest pytest-django
 
-      - name: Run Unit Tests
+      - name: Run tests
         env:
           DATABASE_URL: postgres://postgres:password@localhost:5432/erp_db
         run: |
-          # Pokrećemo testove iz našeg backend direktorija
           pytest backend/modules/invoicing/tests/test_services.py
+          pytest backend/modules/task_management/tests/test_services.py
 
-      - name: Run Task Management Tests
-        env:
-            DATABASE_URL: postgres://postgres:password@localhost:5432/erp_db
-        run: |
-          pytest backend/modules/task_management/tests/test_services.py
\ No newline at end of file
+  deploy:
+    name: Deploy (server git pull + compose)
+    runs-on: ubuntu-latest
+    needs: test
+    if: github.event_name == 'push' && (github.ref_name == 'main' || github.ref_name == 'master')
+    steps:
+      - name: SSH deploy
+        uses: appleboy/ssh-action@v1.0.3
+        with:
+          host: ${{ secrets.DEPLOY_HOST }}
+          username: ${{ secrets.DEPLOY_USER }}
+          key: ${{ secrets.DEPLOY_SSH_KEY }}
+          port: ${{ secrets.DEPLOY_PORT }}
+          script_stop: true
+          script: |
+            set -e
+            export DEPLOY_PATH="${{ secrets.DEPLOY_PATH }}"
+            export DEPLOY_BRANCH="${{ github.ref_name }}"
+            /usr/local/bin/erp-deploy.sh
\ No newline at end of file
diff --git a/backend/core/settings/base.py b/backend/core/settings/base.py
index ab9d1ea..6525f07 100644
--- a/backend/core/settings/base.py
+++ b/backend/core/settings/base.py
@@ -115,7 +115,6 @@ CORS_ALLOW_CREDENTIALS = True
 REST_FRAMEWORK = {
     'DEFAULT_AUTHENTICATION_CLASSES': (
         'rest_framework_simplejwt.authentication.JWTAuthentication',
-        'rest_framework.authentication.SessionAuthentication',
     ),
     'DEFAULT_PERMISSION_CLASSES': (
         'rest_framework.permissions.IsAuthenticated',
diff --git a/backend/core/settings/development.py b/backend/core/settings/development.py
index 91d574f..e414f30 100644
--- a/backend/core/settings/development.py
+++ b/backend/core/settings/development.py
@@ -4,6 +4,18 @@ DEBUG = True
 # ALLOWED_HOSTS = ['localhost', '127.0.0.1', 'backend']
 ALLOWED_HOSTS = ['*']
 
+# CSRF trusted origins (env + poznate domene)
+CSRF_TRUSTED_ORIGINS = [
+    origin.strip()
+    for origin in os.environ.get('CSRF_TRUSTED_ORIGINS', '').split(',')
+    if origin.strip()
+] + [
+    'https://api-004.captain.mitteworkspace.cloud',
+    'https://serviseri-004.captain.mitteworkspace.cloud',
+    'http://localhost:4321',
+    'http://127.0.0.1:4321',
+]
+
 # SQLite za brzi lokalni razvoj (nema potrebe za instalacijom Postgresa na laptopu)
 # DATABASES = {
 #     'default': {
diff --git a/backend/core/settings/production.py b/backend/core/settings/production.py
index b377d1e..525f8b5 100644
--- a/backend/core/settings/production.py
+++ b/backend/core/settings/production.py
@@ -23,6 +23,16 @@ CSRF_COOKIE_SECURE = True
 # Produkcijski CORS (samo domena na kojoj vrti Astro)
 CORS_ALLOWED_ORIGINS = os.environ.get('CORS_ALLOWED_ORIGINS', '').split(',')
 
+# csrf trusted origins za produkciju (env + poznate domene)
+CSRF_TRUSTED_ORIGINS = [
+    origin.strip()
+    for origin in os.environ.get('CSRF_TRUSTED_ORIGINS', '').split(',')
+    if origin.strip()
+] + [
+    'https://api-004.captain.mitteworkspace.cloud',
+    'https://serviseri-004.captain.mitteworkspace.cloud',
+]
+
 # Statika i Mediji
 STATIC_ROOT = '/app/staticfiles'
 MEDIA_ROOT = '/app/media'
\ No newline at end of file